An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2.

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2018-8224)

  - An elevation of privilege vulnerability exists when the     (Human Interface Device) HID Parser Library driver     improperly handles objects in memory. An attacker who     successfully exploited this vulnerability could run     processes in an elevated context.  (CVE-2018-8169)

  - A remote code execution vulnerability exists in Windows     Domain Name System (DNS) DNSAPI.dll when it fails to     properly handle DNS responses. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the Local System     Account.  (CVE-2018-8225)

  - A denial of service vulnerability exists in the way that     the Windows Code Integrity Module performs hashing. An     attacker who successfully exploited the vulnerability     could cause a system to stop responding. Note that the     denial of service condition would not allow an attacker     to execute code or to elevate user privileges. However,     the denial of service condition could prevent authorized     users from using system resources. An attacker could     host a specially crafted file in a website or SMB share.
    The attacker could also take advantage of compromised     websites, or websites that accept or host user-provided     content or advertisements, by adding specially crafted     content that could exploit the vulnerability. However,     in all cases an attacker would have no way to force     users to view the attacker-controlled content. Instead,     an attacker would have to convince users to take action,     typically via an enticement in email or instant message,     or by getting them to open an email attachment. The     security update addresses the vulnerability by modifying     how the Code Integrity Module performs hashing.
    (CVE-2018-1040)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-8207)

  - An elevation of privilege vulnerability exists when NTFS     improperly checks access. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context.  (CVE-2018-1036)

The remote Windows host is missing security update 4284867 or cumulative update 4284826. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Windows kernel fails to properly handle objects in     memory. An attacker who successfully exploited this     vulnerability could run arbitrary code in kernel mode.
    An attacker could then install programs; view, change,     or delete data; or create new accounts with full user     rights.  (CVE-2018-8224)

  - An elevation of privilege vulnerability exists when the     (Human Interface Device) HID Parser Library driver     improperly handles objects in memory. An attacker who     successfully exploited this vulnerability could run     processes in an elevated context.  (CVE-2018-8169)

  - A memory corruption vulnerability exists when Windows     Media Foundation improperly handles objects in memory.
    An attacker who successfully exploited the vulnerability     could install programs; view, change, or delete data; or     create new accounts with full user rights. There are     multiple ways an attacker could exploit the     vulnerability, such as by convincing a user to open a     specially crafted document, or by convincing a user to     visit a malicious webpage. The security update addresses     the vulnerability by correcting how Windows Media     Foundation handles objects in memory. (CVE-2018-8251)

  - A remote code execution vulnerability exists in Windows     Domain Name System (DNS) DNSAPI.dll when it fails to     properly handle DNS responses. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the Local System     Account.  (CVE-2018-8225)

  - A denial of service vulnerability exists when Windows     improperly handles objects in memory. An attacker who     successfully exploited the vulnerability could cause a     target system to stop responding.  (CVE-2018-8205)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-0978,     CVE-2018-8249)

  - A remote code execution vulnerability exists in the way     that the scripting engine handles objects in memory in     Internet Explorer. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-8267)

  - A denial of service vulnerability exists in the way that     the Windows Code Integrity Module performs hashing. An     attacker who successfully exploited the vulnerability     could cause a system to stop responding. Note that the     denial of service condition would not allow an attacker     to execute code or to elevate user privileges. However,     the denial of service condition could prevent authorized     users from using system resources. An attacker could     host a specially crafted file in a website or SMB share.
    The attacker could also take advantage of compromised     websites, or websites that accept or host user-provided     content or advertisements, by adding specially crafted     content that could exploit the vulnerability. However,     in all cases an attacker would have no way to force     users to view the attacker-controlled content. Instead,     an attacker would have to convince users to take action,     typically via an enticement in email or instant message,     or by getting them to open an email attachment. The     security update addresses the vulnerability by modifying     how the Code Integrity Module performs hashing.
    (CVE-2018-1040)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-8207)

  - An elevation of privilege vulnerability exists when NTFS     improperly checks access. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context.  (CVE-2018-1036)

ID	Name	Product	Family	Severity
110501	Security Updates for Windows Server 2008 (June 2018)	Nessus	Windows : Microsoft Bulletins	high
110486	KB4284867: Windows 7 and Windows Server 2008 R2 June 2018 Security Update	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-8224

high

Tenable Plugins

high

high